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Abstract 

The recent application of the principies of quantum mechanics to 
cryptography has led to a remarkable new dimension in secret commu- 
nication. As a result of these new developments, it is now possible to 
construct cryptographic communication systems which detect unau- 
thorized eavesdropping should it occur, and which give a guarantee of 
no eavesdropping should it not occur. 
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1 Cryptographic systems before quantum cryp- 
tography 

A brief description of a classical cryptographic system (CCS) [106] is illus- 
trated in Fig. 1. 
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Figure 1. A classical cryptographic communication system. 

A message, called plaintext P, is encrypted via a secret key K into 
ciphertext C, sent over a non-secure communication channel, and finally 
decrypted via a secret key K' back into readable plaintext P. FoUowing the 
conventions of the cryptographic htcraturc, we will refer to the transmitter 
as Alice, to the receiver as Bob, and to an adversarial cavcsdropper as Eve. 

There are classical cryptographic systems which are perfectly secure 
(see [106]), such as the Vernam cipher, better know as the one time pad, 
which uses a perfectly random key K equal in length to the length of the 
message. The chicf practical diíïiculty with such perfectly secure systems 
is that Alice must first communicate a random key in secret via some to- 
tally secure channel. In most cases, the length of the key makes this secure 
communication impractical and too costly. Because of the large cost of trans- 
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mitting such long keys over a secure channel, Alice is frcqucntly tempted to 
use the same key twice. If shc makcs this fatal mistakc, thcn hcr ciphertext 
immediately changes from being perfectly secure to ciphertext that is easily 
read by Eve. 

Thus, for almost all practical cryptographic systems, the key K is sub- 
stantially shorter than the length of the plaintext. As a result, the ciphertext 
is no longer perfectly secure. However, if the encryption method and key K 
are wisely chosen, then Alice's communication to Bob will bc practically 
secure. By "practically secure," we mean that, although adversary Eve is 
theoretically able to decrypt Alice and Bob's communication without any 
knowledge of their key, she can not do so because the required computa- 
tional time and resources are simply beyond her capability and means. The 
Data Encryption Standard (DES) is believed to be an example of such 
a practically secure encryption system. (See for example [110].) 

In any case, one Achilles heal of classical cryptographic communication 
systems is that secret communication can only take place after a key is com- 
municated in secret over a totally secure communication channel. This is 
frequently referred to as the "catch 22" of cryptography, i.e., 

Catch 22: Before Ahce and Bob can communicate in secret, they must first 
communicate in secret. 

There is even more to this catch 22, namely: 

Catch 22a: Even if Ahce and Bob somehow succeed in communicating 
their key over a secure communication channel, there is simply no classical 
cryptographic mechanism guaranteeing with total certainty that their key 
was transmitted securely, i.e., that their "secure" communication channel is 
free of Eve's unauthorized intrusion. 

As we shall see, quantum encryption does provide a means of circumvent- 
ing this impasse of intrusion detection. 
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A proposed solution to the catch 22 of classical cryptographic communi- 
cation systems is the modern públic key cryptographic system (PKCS) 

as illustrated in Fig. 2. (See [49] [50].) 

For públic key cryptographic systems, it is no longer necessary for Alice 
and Bob to exchange key over a secure channel. Instead, Ahce and Bob both 
create their own individual encryption/decryption key pairs {Ea,Da) and 
{Eb- Db), respectively. Then they both keep their decryption keys and 
Db secret from everyone, including each other, and "publish" or publicly 
broadcast their encryption keys Ea_ and Eb for the entire world to see. The 
security of such a públic key cryptographic system depends on the selection 
of an encryption/decryption algorithm which is a trapdoor function. As 
a result, recovering the decryption key from the encryption key is computa- 
tionally infeasible. The RSA públic key cryptographic system is believed to 
be an example of such a cryptographic system. (See for example [110].) 
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Figure 2. A públic key cryptographic communication system. 

One major drawback to públic key cryptographic systems is that no one 
has yet been able to prové that practical trapdoor functions exist. As a result, 
no one is really sure how secure such públic key cryptographic systems are. 
Moreover, if researchers succeed in building a feasible quantum computer, 
Shor's quantum factoring algorithm [108] could break RSA easily, i.e., in 
polynomial time. 
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Yet another drawback to públic key cryptographic systems is that, in 
tcrms of some everyday implementations, such systems frequently do not 
circumvcnt the catch 22 of classical cryptography after all. The keys for many 
practical públic key cryptographic systems are frequently managed by a key 
bank that is independent of Alice and Bob. Thus, secret Communications 
over a secure channel from the key bank to Alice and Bob are required before 
Alice and Bob can secretly communicate. 

Finally, it should be noted that the most important contribution of quan- 
tum cryptography is a mechanism for detecting eavesdropping. This is a 
totally new contribution to the field of cryptography. Neither classical cryp- 
tographic systems nor públic key cryptographic systems have such a capa- 
bility. In the next section, we will see how quantum mechanics provides a 
means for detecting intrusion. 



2 Preamble to quantum cryptography 

The recent rcsults in quantum cryptography are based on the Heisenberg 
uncertainty principle of quantum mechanics^. Using Standard Dirac no- 
tation^, this principle can be succinctly stated as foUows: 

Heisenberg Uncertainty Principle: For any two quantum mechanical 
observables A and B 

{{AAf){{ABf)>\\\{[A,B])\\\ 

where 

AA^A- (A) and AB ^ B - (B) , 

and where 

[A, B]^AB- BA. 

^For those not familiar with quantum mechanics, please refer to appendix C for a quick 

overvicw. 

^As outlined in Appendix C 
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Thus, {{AAf) and {{ABf) are variances which measure the uncertainty 
of observables A and B. For incompatible observables, i.e., for observables 
A and B such that [A, B] 7^ 0, reducing the uncertainty <^(AA)^) of A forces 
the uncertainty ((Ai?)^) of B to increase, and vice versa. Thus the observ- 
ables A and B can not be simultaneously measured to arbitrary precision. 
Measuring one of the observables interferes with the measurement of the 
other. 

Young's double slit experiment is an example suggesting how Heisen- 
berg's uncertainty principle could be used for detecting eavesdropping in a 
cryptographic Communications. This experiment is illustrated in Fig. 3. 

Alice Bob 




Figure 3. Young's double slit experiment when electron trajectòries are not 
observed. The first of two incompatible observables is measured. 

An electron gun randomly emits electrons over a fairly large angular 
spread. In front of the gun is a metal wall with two small slits. Beyond the 
wall is a backstop that absorbs the electrons that pass through the two slits. 
The probability density pattern of the absorbed electrons is described by the 
curves Pi, P2, and P21 which, for the convcnicncc of the reader, have been 
drawn behind the backstop. The curve Pi denotes the probability density 
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pattern if only slit 1 is open. The curve P2 denotes the probability density 
pattern if only slit 2 is open. Finally, the curve P12 denotes the probability 
density pattern if both slits 1 and 2 are open. Thus, P12 shows a quantum 
mechanical interference pattern demonstrating the wave nature of electrons. 




Figure 4. Young's double slit experiment when electron trajectòries are 
observed by Eve. The second of two incompatible observables is measured. 

Comparing this with our description of a classical cryptographic system, 
the electron gun can be thought of as the transmitter Alice. And the inter- 
ference pattern P12 can be thought of as the message received by Bob. If 
however, Eve tries to eavesdrop by trying to detect through which slit each 
electron passes, as illustrated in Fig. 4, the interference pattern P12 is de- 
stroyed and replaced by the bell curve (which is a classical superposition 
of curves P{ and P2) drawn in Fig. 4, thus demonstrating the particle nature 
of the electron. As a result, Bob knows with certainty that Eve is eavcsdrop- 
ping in on his communication with Alice. Bob knows that, because of the 
Heisenberg uncertainty principle, both the wave and particle natures of the 
electron can not be simultaneously detected. 
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In the next sections, we describe a number of methods, i.e., quantum 
cryptographic communication protocols, that utilizc the Heiscnberg 
uncertainty principle to communicate random binary sequences (i.c, keys) 
with automàtic eavesdrop detection. These quantum communication pro- 
tocols provide a means of circumventing the "catch 22" of classical crypto- 
graphic Systems. As a result, the perfect security of the Vernam cipher (i.e., 
one-time-pad) is an inexpensively implementable reality. 

All the quantum cryptographic systems we discuss in this paper can be 
implemented by transmissions over fiber òptic cable of individual photons, 
each with a single bit encoded in its quantum mechanical state space. We 
describe all of these systems in terms of the polarization states of a single 
photon. It should be noted that they could equally well be described in 
terms of any two-state quantum system. Examples of such a system include 
a spin-i particle, and a two-state level atom. 

The quantum cryptographic protocols discussed will of necessity use some 
encoding scheme (or schemes) which associates the bits and 1 with distinct 
quantum states. We call such an association a quantum alphabet. Should 
the associated states be orthogonal, we call the encoding scheme an orthog- 
onal quantum alphabet. 



3 The BB84 quantum cryptographic protocol 
without noise 

The first quantum cryptographic communication protocol, called BB84, was 
invented in 1984 by Bennett and Brassard [10]'''. This protocol has been 
experimentally demonstrated to work for a transmission over 30 km of fiber 
òptic cable [101] [111] [112] [113], and also over free space for a distance of 
over one hundred mctcrs[80] [67]. It is speculated, but not yet experimentally 
verified, that the BB84 protocol should be implementable over distances of 
at least 100 km. 

In this section we describe the BB84 protocol in a noise free environ- 
ment. In the next section, we extend the protocol to one in which noise is 
considered.^ 

■^Quantum cryptographic protocols evolved from the earher work of Wicsncr [117]. 
"^The proofs given in this and the next section are based on the assumption that Eve uses 
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We now describe the BB84 protocol in terms of the polarization states of 
a single photon. Please note that the BB84 protocol could equally well be 
described in terms of any other two-state quantum system. 

Let Ti. be the two dimensional Hilbert space whose elements representate 
the polarization states of a single photon. In describing BB84, we use two 
difïerent orthogonal bases of Tí. They are the circular polarization basis, 
which consists of the kets 

|rv) and 1-^) 

for right and left circuleir poleirization states, respectively, and the lin- 
eair polEirization ha&\s which consists of the kets 

II) and 1^) 

for vertical and horizontal linear polarization states, respectively. 

The BB84 protocol utilizes any two incompatible orthogonal quantum 
alphabets in the Hilbert space Tí. For our description of BB84, we have 
selected the circuleir políirization quantum alphabet Aq 
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the opaque eavedropping strategy. Other eavesdropping strategies are briefly discussed 
in section 8 of this paper. 
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Bennett and Brassard note that, if Alice were to use only one specific 
orthogonal quantum alphabct for hcr communication to Bob, then Evc's 
eavesdropping could go undetected. For Eve could intercept Alice's trans- 
mission with 100% accuracy, and then imitate Alice by retransmitting her 
measurements to Bob. If, for example, Alice used only the orthogonal quan- 
tum alphabet then Eve could measure each bit of Alice's transmission 
with a device based on some circular polarization measurement operator such 
as 

\r\) {r^\ or \^) 

Or if, Alice used only the orthogonal quantum alphabet Am, then Eve could 
measure each transmitted bit with a device based on some linear polarization 
measurement operator such as 

II) (11 or |^)(^| 

The above strategy used by Eve is called opaque eavesdropping [55] . (We 
will consider other and more sophisticated eavesdropping strategies later.) 



To assure the detection of Eve's eavesdropping, Bennett and Brassard 
require Alice and Bob to communicate in two stagcs, the first stage over 
a one-way quantum communication channcl from Alice to Bob, the second 
stage over a two-way públic communication channel. (Please refer to Figure 
5.) 



3.1 Stage 1. Communication over a quantum channel 



In the first stage, Alice is required, each time she transmits a single bit, 
to use randomly with equal probability one of the two orthogonal alphabets 
^0 or Am- Since no measurement operator of ^0 is compatible with any 
measurement operator of Am, it follows from the Heisenberg uncertainty 
principle that no one, not even Bob or Eve, can receive Alice's transmission 
with an accuracy greater than 75%. 
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Figure 5. A quantum cryptographic communication system for securely 

transfering random key. 

This can be seen as foUows. For each bit transmitted by Alice, one can 
choose a measurement operator compatible with either or A^, but not 
both. Because of incompatibility, thcrc is no simultaneous measurement 
operator for both ^0 and .4^. Since one has no knowledge of Alice's secret 
choice of quantum alphabet, 50% of the time (i.e., with probability |) one 
will guess correctly, i.e., choose a measurement operator compatible with 
Alice's choice, and 50% of the time (i.e., with probability |) one will guess 
incorrectly. If one guesses correctly, then Alice's transmitted bit is received 
with probability 1. On the other hand, if one guesses incorrectly, then Alice's 
transmitted bit is received correctly with probability |. Thus in general, the 
probability of correctly receiving Alice's transmitted bit is 

p = l.i + l.l = ? 

2 2 2 4 
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For each bit transmitted by Alice, we assume that Eve performs one of 
two actions, opaque eavesdropping with probability A, < A < 1, or no 
eavesdropping with probability 1 — A. Thus, if A = 1, Eve is eavesdropping 
on each transmitted bit; and if A = 0, Eve is not eavesdropping at alL 



Because Bob's and Evc's choicc of measurement operators are stochas- 
tically independent of each other and of Ahce's choice of alphabet, Eve's 
eavesdropping has an immediata and detectable impact on Bob's received 
bits. Eve's eavesdropping causes Bob's error rate to jump from | to 

Thus, if Eve eavesdrops on every bit, i.e., if A = 1, then Bob's error rate 
jumps from | to |, a 50% increase. 

3.2 Stage 2. Communication in two phases over a púb- 
lic channel 



In stage 2, Ahce and Bob communicate in two phases over a pubhc channel 
to check for Eve's presence by analyzing Bob's error rate. 



3.2.1 Phase 1 of Stage 2. Extraction of raw key 



Phase 1 of stage 2 is dedicated to ehminating the bit locations (and 
hence the bits at these locations) at which error could have occurred without 
Eves eavesdropping. Bob begins by publicly communicating to Alice which 
measurement operators he used for each of the received bits. Alice then 
in turn publicly communicates to Bob which of his measurement operator 
choices were correct. After this two way communication, Alice and Bob 
delete the bits corresponding to the incompatible measurement choices to 
producc shorter sequences of bits which we call respectively Alice 's raw 
key and Bob's raw key. 
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If there is no intrusion, then Alice's and Bob's raw keys will be in total 
agreement. However, if Evc has been at work, then corresponding bits of 
Ahce's and Bob's raw keys will not agree with probability 



3.2.2 Phcise 2 of Stage 2. Detection of Eve's intrusion via error 
detection 



Alicc and Bob now initiate a two way conversation over the públic channel 
to test for Eve's presence. 

In the absence of noise, any discrepancy between Alice's and Bob's raw 
keys is proof of Eve's intrusion. So to detect Eve, Ahce and Bob select a 
publicly agreed upon random subset of m bit locations in the raw key, and 
publicly compare corresponding bits, making sure to discard from raw key 
each bit as it is revealed. 

Should at least one comparison reveal an inconsistency, then Eve's eaves- 
dropping has been detected, in which case Ahce and Bob return to stage 1 
and start over. On the other hand, if no inconsistències are uncovered, then 
the probability that Eve escapes detection is: 



Thus, if Pfaise is sufficieutly small, Ahce and Bob agree that Eve has not 
eavesdropped, and accordingly adopt the remnant raw key as their final 
secret key. 





For example, if A = 1 and m = 200, then 
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4 The BB84 quantum cryptographic protocol 
with noise 

In this section, the BB84 protocol is extcndcd to a noisy environmcnt. Since, 
in a noisy environment, Alice and Bob can not distinguish between error 
caused by noise and error caused by Eve's eavesdropping, they must and do 
adopt the assumption that all errors in raw key are caused by Eve. 

As before, there are two stagcs to the protocol. 
4.1 Stage 1. Communication over a quantum channel 



This stage is exactly the same as before, except that errors are now also 
induced by noise. 

4.2 Stage 2. Communication in four phases over a 
públic channel 



In stage 2, Alice and Bob communicate over a públic channel in four 
phases. Phase 1 is dedicated to raw key extraction, phase 2 to error esti- 
mation, phase 3 to reconciliation, i.e., to reconciled key extraction, and 
phase 4 to privacy amplificat ion, i.e., extraction of final secret key. 

4.2.1 Phase 1 of Stage 2. Extraction of raw key 



This stage is the same as before, except Alice and Bob also delete those 
bit locations at which Bob should have received but did not receive a bit. 
Such "non-receptions" could be caused by Evc's intrusion or by dark counts 
in Bob's detecting device. The location of the dark counts are, of course, 
communicated by Bob to Alice over the públic channel. 
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4.2.2 Phase 2 of Stage 2. Estimation of error in raw key 



Alice and Bob now use the públic channel to estimate the error rate in 
raw key. They publicly select and agree upon a random sample of raw key, 
publicly compare these bits to obtain an estimate R of the error-rate. These 
revealed bits are discarded from raw key. If R exceeds a certain threshold 

Rmux, thcn it will be impossible for Alicc and Bob to arrive at a common 
secret key. If so, Alicc and Bob rcturn to stagc 1 to start ovcr. On the other 
hand, If the error estimate R does not exceed Rmux, then Alice and Bob 
move onto phase 3. 

4.2.3 Phase 3 of Stage 2. Extraction of reconciled key 



In phase 3^, Alicc and Bob's objective is to remove all errors from what 
remains of raw key to produce an error free common key, called reconciled 
key. This phase is of course called reconciliation, and takes place in two 
steps [6] . 

In step 1, Alice and Bob publicly agrcc upon a random permutation, 
and apply it to what remains of their respective raw keys. Next Alice and 
Bob partition the remnant raw key into blocks of length £, where the length 
£ is chosen so that blocks of this length are unlikely to contain more than 
one error. For each of these blocks, Alice and Bob pubhcly compare overall 
parity checks, making sure each timc to discard the last bit of the comparcd 
block. Each time a overall parity check does not agree, Alice and Bob initiate 
a binary scarch for the error, i.c, bisccting the block into two subblocks, 
publicly comparing the parities for each of these subblocks, discarding the 
right most bit of each subblock. They continue their bisective search on the 
subblock for which their parities are not in agrccment. This bisective search 
continues until the erroneous bit is located and deleted. They then continue 
to the ncxt £-block. 

Step 1 is repeated, i.e., a random permutation is chosen, remnant raw 
key is partitioned into blocks of length i, parities are compared, etc. This is 
done until it becomes inefficient to continue in this fashion. 

^The procedure given in Phase 3 Stage 2 is only one of many possible procedures. In 
fact, there are now much more efficient procedures than the procedure described below. 
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Alice and Bob then move to step 2 by using a more refined reconciliation 
proccdure. They publicly select randomly chosen subsets of remnant raw 
key, publicly compare parities, each time discarding an agreed upon bit from 
their chosen key sample. If a parity sliould not agree, they employ the binary 
search strategy of step 1 to locate and delete the error. 

Finally, when, for some fixed number N of consecutive repetitions of step 
2, no error is found, Alice and Bob assume that to a very high probability, the 
remnant raw key is without error. Alice and Bob now rename the remnant 
raw key reconciled key, and move on to the final and last phase of their 
communication. 

4.2.4 Phase 4 of Stage 2. Privacy amplificat ion, i.e., extraction of 
final secret key 



Alice and Bob now have a common reconciled key which they know is 
only partially secret from Eve. They now begin the process of privacy 
amplificat ion, which is the extraction of a secret key from a partially secret 
one [6] [13]. 

Bascd on their error estimate R, Alice and Bob obtain an upper bound 
k of the number of bits known by Eve of their n bits of reconciled key. Let 
s be a security parameter that Alice and Bob adjust as desired. They then 
publicly select n — k — s random subsets of reconciled key, without revealing 
their contents, and without revealing their parities. The undiscloscd parities 
become the common final secret key. It can be shown that Eve's average 
Information about the final secret key is less than 2"''/ In 2 bits. 



4.3 "Priming the pump" to start authentication 

Unfortunately, there is no known way to initiate authentication without ini- 
tially exchanging secret key over a secure communication channel. So, quan- 
tum protocols have not cntircly overcome the "catch 22" of classical cryp- 
tography. However, this secret key exchange for authentication need only 
be done once. Thereafter, a portion of the secure key communicated via a 
quantum protocol can be used for authentication. 
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5 The B92 quantum cryptographic protocol 



As with the BB84 quantum protocol, the B92 protocol [7] can be described 
in terms of any quantum system represented by a two dimensional Hilbert 
space. For our description, we choose the two dimensional Hilbert space H. 
representing the polarization states of a single photon. 

B92 can be implemented in terms of any non-orthogonal basis. We choose 
as our non-orthogonal basis the kets 

1^) and \e) , 

where \9) and denote respectively the kets representing the polarization 
state of a photon linearly polarized at an angle 6 and an angle —6 with 
respect to the vertical, where < 9 < n/A. 

Unhke BB84 which requires two orthogonal quantum alphabets, B92 re- 
quires only a single non-orthogonal quantum alphabet. We choose the non- 
orthogonal quantum alphabet Aq: 
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As in BB84, Alice and Bob communicate in two stages, the first over a 
one-way quantum channel, the second over a two-way públic channel. 



5.1 Stage 1. Communication over a quantum channel 

Alice uses the quantum alphabet Ae to send her random binary sequence to 
Bob. Since |^) and \9) are not orthogonal, there is no onc experiment that 
will unambiguously distinguish between these two polarization states. 



19 



Bob can use one of many possible measurement strategies. Bcnnctt [7] 
suggests the measurement s be based on the two incompatible experiments 
corresponding to the projection operators 

p^e^i- \e) {e\ and p^e = 1 - \e) {e\ 

In this case, Bob either correctly dctccts Alicc's transmitted bit, or an am- 
biguous result, i.e., an erasure, dcnoted by "?". Assuming that Alice trans- 
mits O's and l's at random with cqual probability and that, for each incoming 
bit, Bob at random with equal probability chooses to base his experiment 
on either of the incompatible operators P^e or P_,^, then the probability of 
Bob's correctly receiving Alice's transmission is 

i-iK^i^)ir 

2 

and the probability of receiving an erasure is 

2 

where 

11(^1^)11= cos (2^) 
and where < 9 < n/A. Thus, Bob receives more than 50% erasures. 



On the other hand, Ekert et al [55] suggest a more efïicient measurement 
process for Bob. They suggest that Bob base his experiments on the positive 
operator valued measure (POVM) [36] [99] consisting of the operators 

P Q P - 

Aq — n-T" — =rn", = ,, ,, , and A-r — 1 — Aq — At, 

1+ (^1^) ' ' 1+ (eie '" • ' 



With this more efïicient detection method, the probability of an inconclusive 
result is now 



[e I ^>|| =cos(2^) 

where again < 6* < 7r/4. 
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5.1.1 Stage 2. Communication in four phases over a públic chan- 
nel 

Stage2 for the B92 protocol is the same as that for the BB84 protocol except 
for phase 1. 

In phase 1 of stage 2, Bob publicly informs Alice as to which time slots he 
received non-erasures. The bits in these time slots become Alice's and Bob's 
raw keys. 

Eve's presence is detected by an unusual error rate in Bob's raw key. It 
is also possible to detect Eve's presence by an unusual erasure rate for Bob. 
Howcvcr, Ekert et al [55] do point out that Eve can choose eavesdropping 
strategies which have no effect on the erasure rate, and hence, can only be 
detected by unusual error rates in Bob's raw key^. 



6 EPR quantum cryptographic protocols 

Ekert in [60] has devised a quantum protocol based on the properties of 
quantum-correlated partides. 

Einstein, Podolsky, and Rosen (EPR) in the their famous 1935 paper [64] 
challenged the foundations of quantum mechanics by pointing out a "para- 
dox." There exist spatially separated pairs of partides, henceforth called 
EPR pairs, whose states are correlated in such a way that the measure- 
mcnt of a chosen observable A of one automatically determines the result of 
the measurement of A oi the other. Since EPR pairs can be pairs of partides 
separated at great distances, this leads to what appears to be a paradoxical 
"action at a distance." 

For example, it is possible to create a pair of photons (each of which we 
labcl bclow with the subscripts 1 and 2, rcspcctivcly) with correlated linear 
polarizations. An example of such an cntangled statc is givcn by 

^(i»Mi),-li)j»>^) 

^This is true for all 2-state protocols. On the othcr liand, for n-statc protocols with 
n> 2, Eve's presence is always detectable from rejected key. See section 7 of this paper. 
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where the notation \9) has bccn defined in the previous section. Thus, if 
one photon is measurcd to be in the vertical hnear polarization state |0), the 
other, when measured, will be found to be in the horizontal hnear polarization 
state |7r/2), and vice versa. 

Einstein et al [64] then state that such quantum correlation phenomena 
could be a strong indication that quantum mechanics is incomplete, and that 
there exist "hidden variables," inaccessible to experiments, which explain 
such "action at a distance." 

In 1964, Bell [4] gave a means for actually testing for locally hidden 
variable (LHV) theories. He proved that all such LHV theories must satisfy 
the Bell inequality. Quantum mechanics has been shown to violate the 
inequality. 

The EPR quantum protocol is a 3-state protocol that uses Bell's in- 
equality to detect the presence or absencc of Eve as a hidden variable. Fol- 
lowing the thcmc of this paper, we now describc this protocol in tcrms of the 
polarization statcs of an EPR photon pair. As the three possible polarization 
States of our EPR pair, we choose 

l^o) = ^(|0),|f>,-|f>jO),). 

I^i) = 7i(li>ilï>2-|ï>ilf>2)'--d 

m = ò=M)M).-m.n).) 



For each of these states, we choose the following corresponding mutually 
non-orthogonal alphabets ^o, ^i,and ^2, given by the following tables: 



Symbol 


Bit Symbol 


Bit Symbol 


Bit 


|0) 





}\ 





'1tt\ 







37r\ 
6 / 


1 


47r \ 
6 / 


1 


6 / 


1 











Linear Polarization Linear Polarization Linear Polarization 

Quantum Alphabet Aq Quantum Alphabet A\ Quantum Alphabet A2 



The corresponding measurement operators chosen for these alphabets are 
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respectively 



Mo=\0){0\, Ml 



71 



6 




271 



6 




2% 



6 



As with the BB84 and B92 , there are two stages to the EPR protocol, 
the first stage over a quantum channel, the second over a públic channel. 



6.1 Stage 1. Communication over a quantum channel 

For each time slot, a state is randomly selected with equal probability 
from the set of states {\^o) ; l^i) > 1^2)}- Than an EPR pair is created in 
the selected state One photon of the constructed EPR pair is sent to 

Alice, the other to Bob. Ahce and Bob at random with equal probability 
separatcly and indcpcndcntly select one of the three measurement operators 
AÍq, Aii, and AÍ2, and accordingly measure their respective photons. Alice 
records her measured bit. On the other hand, Bob records the complement 
of his measured bit. This procedure is repeated for as many time slots as 



6.2 Stage 2. Communication over a públic channel 

In stage 2, Alice and Bob communicate over a públic channel. 

6.2.1 Phcise 1 of Stage2. Sepeiration of key into raw and rejected 



In phase 1 of stage 2, Alice and Bob carry on a discussion over a públic chan- 
nel to determine those bit slots at which they used the same measurement 
operators. They each then separate their respective bit sequences into two 
subsequences. Onc subsequencc, called raw key, consists of thosc bit slots at 
which they used the same measurement operators. The other subsequence, 
called rejected key, consists of all the remaining bit slots. 



needed. 



keys 
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6.2.2 Phase 2 of Stage 2. Detection of Eve's presence with Bell's 
inequality applied to rejected key 

Unlike the BB84 and B92 protocols, the EPR protocol, instead of discarding 

rejected key, actually uses it to detect Eve's presence. Alice and Bob now 
carry on a discussion over a públic channel comparing their respective re- 
jected keys to determine whether or not Bell's inequality is satisfied. If it is, 
Eve's presence is detected. If not, then Eve is absent. 

For the EPR protocol. Bell's inequality can be written as foUows. Let 
P (t^I i, i) denote the probability that two corresponding bits of Ahce's and 
Bob's rejected keys do not match given that the measurement operators 
chosen by Alice and Bob are respectively either Aíj and M.j or Aíj and Aíj. 
hetP{=\i,j)^l-P{^\i,j). Let 

A(i,i) = P(^| i,3)-PH hJ) 

Finally, let 

/3=1 + A(1,2)-|A(0,1)-A(0,2)| 

Then Bell's inequality in this casc rcduces to 

/? > 

Moreover, for quantum mechanics (i.e., no hidden variables) 




which is a clear violation of Bell's inequality. 



6.2.3 Phase 3 of Stage 2. Reconciliation 

In the presence of noise, the remaining phase of the EPR protocol is recon- 
ciliation, as described in the BB84 and B92 protocols. 
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7 Other protocols 



It is not possible to cover all possible quantum protocols in this paper. There 
is the EPR protocol with a single particle. There is also a 2-state EPR 
implementation of the BB84 protocol. For detalls, see [12] [46]. For various 
múltiple state and rejected data protocols, see [21]. 

8 Eavesdropping strategies and counter mea- 
sures 

There are many eavesdropping strategies available to Eve. (See for example 
[55], [24].) We list only a few. 



8.1 Opaque eavesdropping 

For this strategy, Eve intercepts Alicc's message, and then masquerades as 
Alice by sending her received message on to Bob. Opaque eavesdropping 
has already been discussed in sections 4 and 5 of this paper. For more 
Information, the reader is referred to [55]. 



8.2 Translucent eavesdropping without entanglement 

For this strategy, Eve makes the Information carrier interact unitarily with 
her probe, and then lets it proceed on to Bob in a slightly modified state. 
In the case of the B92 protocol, Eve's detection probe with initial state 1^^) 
would perform a unitary transformation U of the form 
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where \9') and 9 j denote the slightly changed states received by Bob after 

the action of the probe, and where \^e) and jí^^) denote the states of the 
probe after the transformation.. We refer the reader to [55] for an in depth 
analysis of this eavesdropping strategy. 



8.3 Translucent eavesdropping with entanglement 

For this strategy, Eve entangles the state of her probe and the carrier, and 
then she sends the carrier on to Bob. In the case of the B92 protocol, Eve's 
detection probe with initial state |^) would perform a unitary transformation 
U of the form 

1^) I*) ^ U \9) I*) = a \9) \^>e) + h \9) |*^) 

1^) 1^) ^ U \9) 1^) = b \9) \^e) + a \9) 1^^) 

Wc refer the reader to [55], [24] for an in depth analysis of this eavesdropping 
strategy. 



8.4 Countermeasures to Eve's eavesdropping strate- 
gies 

As far as the author has been ablc to dctcrmine, all quantum intrusion detec- 
tion algorithms in the open literature depend on some assumption as to which 
eavesdropping strategy is chosen by Eve. It is important that eavesdropping 
algorithms be developed that detect Eve's intrusion no matter which eaves- 
dropping strategy she chooses to use. (For some insight in intrusion detection 
algorithms, the reader is referred to [55], [24].) 



9 Conclusion 

It is not easy to emphasize how dramàtic an impact the application of quan- 
tum mechanics has had and will have on cryptographic communication sys- 
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tems. From the perspective of defensive cryptography, it is now within the 
rcalm of possibility to build practical cryptographic systems which chcck for, 
detect, and prevent unauthorized intrusion. Quantum mechanics provides 
an intrusion detection mechanism never thought possible within the world 
of classical cryptography. Most importantly, the feasibihty of these methods 
has been experimentally verified in a laboratory setting. 

Moreover, from the perspective of offensive cryptography, the apphcation 
of quantum mechanics to computation also holds forth the promise of a dra- 
màtic increase of computational parallehsm for cryptanalytic attacks. Shor's 
quantum factoring algorithm [107] [57] is just one example of such potentiaL 
However, unhke quantum protocols, quantum computational parallelism has 
yet to be fuUy verified in a laboratory setting. 

Much remains to be done before quantum cryptography is a truly prac- 
tical and useful tool for cryptographic communication. We list below some 
of the areas in need of development: 

• Quantum protocols need to be extended to a computer network setting. 
(See [102] and [115].) 

• More sophisticated error correction and detection techniques need to 
be implemented in quantum protocols. (See [6], [13], and [18].) 

• There is a need for greater understanding of intrusion detection in the 
presence of noise. The no cloning theorem of Appendix A of this paper 
and the "no detection implies no Information" theorem of Appendix B 
of this paper simply do not provide a complete picture. (See [55].) 

• There is a need for better intrusion detection algorithms. As far as 
the author has been able to determine, all quantum intrusion detection 
algorithms in the open litcrature depend on some assumption as to 
which eavesdropping strategy is chosen by Eve. It is important that 
eavesdropping algorithms be developed that detect Eve's intrusion no 
matter which eavesdropping strategy she uses. (See [55].) 
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11 Addendum 

Quantum cryptography has continued its ràpid pace of development since 
this paper was written. There is the recent experimental work found in [93] , 
[94]. Progress has been made in correcting errors received from noisy channels 
[32], [33], [62], [63]. A number of protocols, in particular, the quantum bit 
commitment protocol, have been shown to be insecure [83], [84], [86]. There 
has been progress in the development of multi-user quantum cryptography 
[116]. The sccurity of quantum cryptography against collectivc kcy attacks 
has been studied [20]. There have been at least two independent claims of 
the proof of ultimate security of quantum cryptography, i.e., security against 
all possible attacks [85], [87], [88], [89]. Finally, although tangentially related 
to this paper, it should be mentioned that a new quantum algorithm for 
searching databases has been developed [71], [72], [73]. 
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12 Appendix A. The no cloning theorem 

In this appendix, we prové that there can be no device that produces exact 
replicas or copies of a quantum system. If such a "quantum copier" existed, 
then Eve could eavesdrop without detection. This proof is taken from [99] . 
It is an amazingly simple application of the linearity of quantum mechanics. 
(See also [119] for a proof using the creation operators of quantum electro- 
dynamics.) 

Let us assume that thcrc cxists a quantum replicator initially in state 
1^) which duphcates quantum systems via a unitary transformation U. 

Let \u) and \v) be two arbitrary states such that 

0<\\{u\v)\\<l. 
Then the apphcation of the quantum rephcator to \u) and \v) yields 

I*) \u) ^ C/|*) \u) = I*') \u) \u) 

I*) \v) ^U\-^) \u) = I*") \v) \v) 

where |^') and denote the states of the quantum rephcator after the 
two respective duphcations. 

Thus, 

{u\ (^1 U^U 1^) \v) = {u\ I ^) \v) = {u\v), 
because of the unitarity of U and because | í^) = 1. On the other hand, 

{u\ {u\ I \v) \v) = I {u I vf . 
As a result, we have the equation 

{u\v) = I {u I vf 

But this equation cannot be satisfied since ||(^' | ^")|| < 1 and \u) and \v) 
wcrc chosen so that < ||(tí | w )|| < 1. 

Hence, a quantum rephcator cannot exist. 
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13 Appendix B. Proof that an undetectable 
eavesdropper can obtain no information 
from the B92 protocol 

In this appendix we prové that an undetectable eavesdropper for the B92 
protocol obtains no information whatsoever. The proof is taken from [12]. 

Let \a) and \b) denote the two non-orthogonal states used in the B92 
protocol''. Thus, 

{a\b) ^0 

Let U be the unitary transformation performed by Eve's detection probe, 
which we assume is initially in state |^). 

Since Eve's probe is undetectable, we have 

I*) \a) ^ C/|*) \a) = I*') \a) 

1^) \b) ^ \b) = \^") \b) 

where and denote the states of Eve's prober after the detection 

of \a) and |ò) respectively. Please note that, since Eve is undetectable, her 
probe has no eíïect on the states \a) and |ò). So \a) appears on both si des of 
the first equation, and \b) appears on both sides of the second equation. 
Thus, 

(a| (^1 U^U 1^) |6) = {a\ | ^) |6) = {a \ b) , 
because of the unitarity of U and because | = 1. On the other hand, 

(a| I |ò) = I (a I ò) . 
As a result, we have the equation 

(a I 6) = I (a I b) 

But (a I ò) 7^ imphes that (í'' | í'") = 1. Since \-^') and are 
normalized, this implies that 1^^') = 1^")- K foUows that Eve's probe is in 
the same state no matter which of the states \a) and \b) is received. Thus, 
Eve obtains no information whatsoever. 

''In section 6 of this paper we denoted these states by |^) and |^). 
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14 Appendix C. Part of a Rosetta stone for 
quant um mechanics. 



This appendix is intended for readers unfamiliar with quantum mechanics. 
It's purpose is to provide those readers with enough background in quantum 
mechanics to understand a substantial portion of this paper. Because of 
space hmitations, this appendix is of necessity far from a complete overview 
of the subject. 

14.1 Polarized light: Part I. The classical perspective 

Light waves in the vacuum are transverse electromagnètic (EM) waves with 
both elèctric and magnètic field vectors perpendicular to the direction of 
propagation and also to each other. (See figura 6.) 



fy 




Figure 6. A linear ly polarized electromagnètic wave. 



If the elèctric field vector is always parallel to a fixed line, then the EM 
wave is said to be lineeirly poleirized. If the elèctric field vector rotates 
about the direction of propagation forming a right-(left-)handed screw, it is 
said to be right (left) elliptically polarized. If the rotating elèctric field 
vector inscribes a circle, the EM wave is said to be right-or left-circularly 
poleirized. 
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14.2 A Rosetta stone for Dirac notation: Part I. Bras, 
kets, and bra-(c)-kets 

A Hilbert space 7i is a vector space over the complex numbers C with a 
complex valued inner product 

(-,-) -.nxu^c 

which is complete with respect to the norm 

= a/ {u,u) 

induced by the inner product. 

Remark 1 By a complex valued inner product, we mean a map 

(-,-) -.nxn^c 

from H X H into the complex numbers C such that: 

1) (m, tí) = if and only if u = 

2) {u,v) = {v,u)* 

3) (li, V -\-w) — {u, v) + {u, w) 

4) {u, Xv) = X{u, v) 

where '* ' denotes the complex conjugate. 
Remcírk 2 (Please note that {\u,v) = \*{u,v). ) 

The elements of H will be called ket vectors, state kets, or simply 
kets. They will be denoted as: 

I lahel ) 

where ^laheV denotes some label. 

Let denoto the Hilbert space of all Hilbert space morphisms of H. into 
the Hilbert space of all complex numbers C, i.e., 

n* = Home (H, C) . 
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The clements of H* will be called bra vectors, state bras, or simply bras. 
They will be denoted as: 

( lahel I 

where once again HabeV denotes some label. 
Also please note that the complex number 

( labeli I (I label2 )) 

will simply be denoted by 

( labeli I label2 ) 

and will be called the bra-(c)-ket product of the bra {labeh \ and the ket 
I label2 )■ 

There is a monomorphism (which is an isomorphism if the underlying 
Hilbert space is finite dimensional) 

defined by 

I label ) I — > ( I label ) , — ) 

The bra ( | label ) , — ) is denoted by ( label \ . 
Hence, 

( labeli I label2 ) — { \ labeh ) , | label2 )) 



Remcírk 3 Please note that (A | label ))* — X* {label\ . 

The tensor product^ H <^ JC oí two Hilbert spaces H and JC is simply 

the "simplest" Hilbert space such that 

^Rcadcrs well versed in homological àlgebra will rccognizc this informal dcfinition as a 
slightly disguised version of the more rigorous universal definition of the tensor product. 
Fer more detalls, please refer to [37], or any other Standard reference on homological 
àlgebra. 
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1) {hi + ® k = hi® k -\- k, for all h, hi, h2 & H and for all k, 
ki, k2 & /C, and 

2) h® {ki-\-k2) — h®k-i-\-h®k2 for all h, hi, h2 E H and for all k, 
ki, k2 e /C. 

It immediately foUows that 

3) X{h(^k) = (Xh) (8) A; = /i ® (A/c) for all X e C, h e H, k e JC. 

Finally, if | labeh ) and | /aòe/2 ) are kets respectively in Hilbert spaces TCi 
and 7^2, then their tensor product will be written in any one of the foUowing 
three ways: 

I labeh ) | /aòe/2 ) 
I labeli ) I label2 ) 
I labeli , label2 ) 



14.3 Polarized light: Part II. The quantum mechanical 
perspectiva 

The States of a quantum mechanical system are represented by state kets 
in a Hilbert space Tí. Two kets jo;) and \(5) represent the same quantum 
mechanical statc if thcy diffcr by a non-zero multiplicative constant. I.e., 
\a) and \l3) represent the same quantum mechanical state if there exists a 
non-zero A G C such that 

|«) = A|/3) 

Hence, the quantum mechanical states are the elements of the manifold 

n/~ ^ cp" 

where n denotes the dimension of 7í, and CP" denotes complex projective 
space. 
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Convention: Since a quantum mechanical state is represented by a state 
ket up to a multiplicative constant, we will unless stated otherwise, 
choose those kets \a) which are unit normal, i.e., such that 

{a \ a) — 1 <í=^ II |q;)|| = 1 



The polarization states of a photon are represented as state kets in a two 
dimensional Hilbert space H. One orthonormal basis of H consists of the 
kets 

|^^^) and \r\) 

which represent respectively the quantum mechanical states of Icft- and right- 
circularly polarized photons. Another orthonormal basis consists of the kets 

II) and 1^) 

representing respectively vertically and horizontally linearly polarized pho- 
tons. And yet another orthonormal basis consists of the kets 

I/) and |\) 

for linearly polarized photons at the angles 6 = ir/A and 6 = — 7r/4 off the 
vertical, respectively. 

These orthonormal bases are related as foUows: 

I/) - + j \/) = + 

l\) = 7s(lt)-l-)) 1 N) = ¥I^) + ¥M 



11) = 73(l/) + l\)) 



ll> = 73(l^) + l^)) 
1^) = ^(l^)-l^)) 
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The bracket products of the various polarization kets are given in the 
table below: 





II) 




1/) 


|\) 






(11 


1 





1 


1 


1 

^^ 


1 

V2 









1 






^^ 


i 


(/I 


1 


1 


1 





1+i 
2 


\-i 

2 


(\ 











1 


1-i 
2 


1+i 
2 






1 

V2 




1-; 

9 


1 + 7' 

2 


1 









1 
V2 


z 

^/2 


1+i 
2 


í-i 
2 





1 



14.4 A Rosetta stone for Dirac notation: Part II. Op- 
erators 

An (linear) operator or transformation (9 on a ket space 7i is a Hilbert 
space morphism of Tí into 7i, i.e., is an element of 

Home (n, n) 

The adjoint of an operator O is that operator such that 
(O^ I laheh ) , I labek )) = (| labeh ) ,0\ labek )) 

for all kets | labeli ) and | label2 )• 

In like manner, an (linear) operator or transformation on a bra space H* 
is an element of 

Home {n*,H*) 
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Moreover, each operator O on Ti. can be identified with an operator, also 
denoted by on 7ï* defined by 

( labeli I I — > { labeli \ O 

where ( labeli \ O is the bra defined by 

(( labeh I O) (I labeh)) = ( labeh \ {O \ labek)) 

(This is sometimes called Dirac's associativity law.) Hence, the expression 

( labeli I O I label2) 

is unambiguous. 

Remcírk 4 Please note that 

{O I label))* = {label\ 

In quantum mechanics, an observable is simply a Hermitian (also 
called self-adjoint) operator on a Hilbert space i.e., an operator O such 
that 

= . 

An eigenvalue a of an operator A is a complex number for which there is a 
ket \labeï) such that 

A \ label) = a \ label) . 
The ket \label) is called an eigenket of A corresponding to the eigenvalue a. 

An important theorem about observables is given below: 

Theorem 5 The eigenvalues üí of an observable A are all real numbers. 
Moreover, the eigenkets for distinct eigenvalues of an observable are orthog- 
onal. 
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Definition 6 An eigenvalue is degenerats if there are at least two linearly 
independent eigenkets for that eigenvalue. Otherwise, it is nondegenerate. 

Notational Convention: If all the eigenvalues Oj of an observable A are 
nondegenerate, then we can and do label the eigenkets of A with the 
eigenvalues Oj. Thus, we can write: 

A \ai) = üi \ai) 

for each eigenvalue Oj. In this paper, unless stated otherwise, we assume 
that the eigenvalues of observables are non-degenerate. 

One exception to the above notational convention is the measurement 
operat or 

for the eigenvalue Oj, which is the outcr product of ket \ai) with its ad- 
joint {ai\. It has two eigenvalues and 1. 1 is a nondegenerate eigenvalue 
with eigenket |aj). is a degenerate eigenvalue with corresponding eigenkets 

An observable A is said to be complete if its eigenkets \ai) form a basis 
(hence, an orthonormal basis) of the Hilbcrt space 7í. Given a complete 
nondegenerate observable A, then any ket inTi can be written as: 

i 

Thus, for a complete nondegenerate observable A, we have the foUowing 
operator equation which expresses the completeness of A, 

Y \ai) {ai\ = 1 

i 

Thus, in this notation, we have 
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14.5 Quantum measurement: General principies 

In this section, A will denote a complete nondegenerate observable with 
eigenvalues Oj and eigenkets |aj) . 

According to quantum measurement theory, the measurement of an ob- 
servable Aoí a ket witli respect to the basis {|cii)} produces the eigenvalue 
üi with probability 

Pro6 (Value Oj is observed) = ||(aj | ■0)11^ 

and forces the state of the quantum system to become the corresponding 
eigenket |aj). 

Since quantum measurement is such a hotly debated tòpic among physi- 
cists, we (in self-defense) quote P.A.M. Dirac[51]: 

"A measurement always causes the (quantum mcchanical) system 
to jump into an cigenstate of the dynamical variable that is being 
measured." 



Thus, the above mentioncd measurement of observable A of ket can 
be diagrammatically represented as foUows: 



Meas. of A Meas. of A 

1^) («í I V') ^ % 1%) ~ 1%) =^ 

i Prob = \\{aj \ ip)f Prob=l 



The observable 

Wi) (etil 

is frequently called a selective mezisurement operator (or a filtration) 

for Oj. As mentioned earlier, it has two eigenvalues and 1. 1 is a nonde- 
generate eigenvalue with eigenket \ai), and is a degenerate eigenvalue with 
eigenkets {\aj)}._^.. 

Thus, 

Wi) {ai\ 

=^ 1 • \ai) = \ai) , 

Prob^\\{ai\iP)\f 
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but for j i, 



\ai) {ai 



• \aj) = 



Prob = \\{aj 



14.6 Polarized light: Part III. Three examples of quan- 
tum measurement 

We can now apply the above general principies of quantum measurement to 
polarized light. Three examples are given below:^ 

Example 7 

Vertically 
polarized 
Prob = I photon 

=^ \l) 

=^ 
Prob = i No photon 



Rt. Circularly 
polarized photon 



1 

V2 



(ID + ^M) 



Vertical 
Polaroid 

filter 




Measurement op. 



Example 8 A vertically polarized filter foUowed by a horizontally polarized 
filter. 

^The last two examples can easily be verified experimentally with at most three pair 
of polarized sunglasses. 
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Entangled 
photon 

Normalized so that 
\\af + mf = l 




Prob 



II) (II 



Vert. 
|q;||^ polar, 
photon 

II) 




Prob 



Example 9 Buf, if we insert a diagonally polarized filter (by 45° ojf the ver- 
tical) between the two polarized filters in the above example, we have: 




where the input to the first filter isa;||)+/?|·<-^). 

14.7 A Rosetta stone for Dirac notation: Part III. Ex- 
pected vàlues 

The average value (expected value) of a measurement of an observable 
A on a state \a) is: 

{A) = {a\ A \a) 

For, since 

\ai) {ai\ = 1 , 

i 
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we have 



But on the other hand, 



Thus, 



(A) = ^ (a I Oj) tti {tti I g) = 



Oí II (oí I a)||^ 



Hence, we have the Standard expected value formula, 

(A) — üiProb (Observing Uj on input \a)) 



14.8 Dynamics of closed quantum systems: Unitary 

transformations, the Hamiltonian, and Schròdinger's 
equation 

An operator U on a Hilbert space 7i is unitary if 

C/t = . 

Unitary operators are of central importance in quantum mechanics for many 
reason. We hst below only two: 

• Closed quantum mechanical systems transform only via unitary trans- 
formations 

• Unitary transformations preserve quantum probabilities 
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Let \ip{t)) denote the state of a closed quantum mechanical system S as 
a function of time t. Then the dynamical behavior of S is determined by the 
Schròdinger equation 

and boundary conditions, where H denotes Planck's constant and H denotes 
an observable of S called the Hamiltonian. The Hamiltonian is the quan- 
tum mechanical analog of the Hamiltonian classical mechanics. In classical 
physics, it is the total energy of the system. 

14.9 There is much more to quantum mechanics 

There is much morc to quantum mechanics. For more in-depth ovcrvicws, 
there are many outstanding books. Among such books arc [65], [104], [51], 
[95], [99], and many more. Some excellent insights into this subject are also 
given in chapter 2 of [97]. 
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